Posted
by
Soulskill
on Friday October 24, 2014 @04:26PM
from the doing-the-wrong-thing-badly dept.

An anonymous reader writes: Verizon Wireless, the nation's largest wireless carrier, is now also a real-time data broker. According to a security researcher at Stanford, Big Red has been adding a unique identifier to web traffic. The purpose of the identifier is advertisement targeting, which is bad enough. But the design of the system also functions as a 'supercookie' for any website that a subscriber visits. "Any website can easily track a user, regardless of cookie blocking and other privacy protections. No relationship with Verizon is required. ...while Verizon offers privacy settings, they don’t prevent sending the X-UIDH header. All they do, seemingly, is prevent Verizon from selling information about a user."
Just like they said they would.

To be honest, I don't think this does anything. I think a VPN might be the only current way to avoid this, as your traffic in a VPN tunnel is theoretically not seen by the routers that pass it. I'm not sure if deep packet inspection tools could add the unique ID. I'm not a network engineer, so I don't know for sure. I do know that VPNs of today are rapidly becoming easier to circumvent by those who would do so.

I don't think you could modify packets that are in an ssl stream and not have ssl detect it and reject the 'broken' packets.

https is mostly secure (other than MitM attacks on certs) and vpn's are also very secure.

I have a vpn and while I use it mostly at home, there is an android client (even for my ancient 2.x android o/s) for the vpn provider I have and so I could get as complete privacy as possible on my phone, while doing inet things.

nope, he's right. Your adversary is the site, not verizon. And the site can make you request non-http stuff, where verizon (which is not the main enemy) injects an id, which can then be read by the site. There is not much protection without using extreme measures like requestpolicy (and not allowing anything using http).

you're still not getting the szenario, just as i did not in my first post.

VZW does not want to interfere for this szenario. They interfere with http adding an id and ignore https. The website wants your identification. So they generate a token on the https-site and load image.jpg?token from a http(without s) site. Then they know a token vzw correlation and can assign the same token on your next visit.

And lose access to several websites. Slashdot, for example, redirects HTTPS hits to HTTP for non-subscribers because ad networks have been slow to implement HTTPS. And a lot of shared web hosts don't support HTTPS because their policies haven't been updated in the six months since the last major Server Name Indication-ignorant desktop web browser (IE on Windows XP) reached end of support in April. But HTTPS support is the second biggest reason I stopped going to TV Tropes in favor of All The Tropes (after licensing [slashdot.org]).

That's the problem with monopolies (natural or otherwise). Still, there is an option to sign up for just the phone plans without wireless data and use wired or satellite ISPs for internet access.

You could also go the route of circumventing the problem (using the methods others have already suggested) with a bit of added effort/cost, but in that case there's no disincentive to help persuade Verizon to stop the program.

Unacceptable. Verizon licensed the spectrum from citizens, and therefore has certain obligations.

This is what should occur. Make use of any spectrum contingent upon a series of consumer friendly policies. Failure to comply requires turning the spectrum and any technology that uses it or assists in its use over to auction. Then establish a rule that prohibits anyone over a pay grade access to any industry that uses spectrum for a predetermined duration.

If you set the concequesnces high enough than ideas like this get shot down in the board room.

bullshit. They bought it from the government, whose representation of its citizens occurs roughly every 5 years for a fortnight. Apart from that time, they do what they like. And even in that fortnight they just tell you what you wanted to hear anyway.

USA, so more like every two years for the federal government (this is an election year for congress, though not for the presidency) and it lasts a lot longer than a fortnight (which, it should be mentioned, is a word only very rarely used on this side of the pond) due to the degree of campaigning that people do here (though it's definitely a bigger deal on the presidential years).

No argument on the "tell you what you wanted to hear anyway" part, though! Something so far removed from the few very carefully c

As a sysadmin, you should know that it is easy and cheap to rent a VPS (Virtual Private Server). Then, run squid on the server, or do some fancy routing to send all your web traffic out via a VPN to your VPS. Since most VPS services offer a minimum of 1TB of monthy data, there should not be any excess data usage charges.

In order to stop being a Verizon customer, someone who requires home or mobile Internet access for his way of life might have to move his family away from territory serviced by Verizon, either as the DSL ILEC or as the only wireless carrier with acceptable coverage. Consensus in comments to previous Slashdot articles is that almost nobody is willing to spend the time and money to move just to change ISPs.

Not just sexual harassment. It's safer for a supermodel to walk down MLK in your favorite large city naked than a homely woman to walk from one end of Fort Hood to the other, wearing ACUs after dark.
When soldiering becomes less of a duty and more of a way to delay starting out your life of dismal poverty, you start making the wrong kind of army.

It's safer for a supermodel to walk down MLK in your favorite large city naked than a homely woman to walk from one end of Fort Hood to the other, wearing ACUs after dark.
When soldiering becomes less of a duty and more of a way to delay starting out your life of dismal poverty, you start making the wrong kind of army.

I have come to the conclusion that anything the geek says about women, rape or the military needs to be fact-checked.

A cash-strapped female soldier told a Fort Hood hearing board Tuesday about how a noncommissioned sexual assault prevention officer on base forced her into a prostitution ring so she could buy groceries for her child.

The private testified against Sgt. 1st Class Gregory McQueen during a proceeding similar to a grand jury hearing. McQueen could face some 21 criminal charges if he is slapped with a military court-martial.

''Basically, it was having sex with higher ranking officers for money," the woman told the board.

The private, who was 20 and struggling as a single mother of a 3-year-old child at the time of the alleged prostitution, was granted immunity in return for her testimony. She told the board how McQueen snapped pics of her naked to distribute to potential clients. The two also had sex so McQueen could see how she would ''act out'' with clients.

McQueen, who has since been relieved from his sexual assault prevention duties, faces charges of pandering, conspiracy, adultery and sexual assault.

Another female private claims McQueen sexually assaulted her when he tried to recruit her into the military sex ring.

That woman told investigators that McQueen ''preys on young females who are in bad financial situations and that he keeps their pictures on his cell phone,'' the Austin American-Statesman reported in December.

I have a good friend there right now. There have been 2 attempts on her where she had to physically fight someone off of her, and the first 2 days of reception were sexual assault awareness classes where they're instructed to stay out of the dark and not go anywhere on-base that they're not familiar with or get into any cars they're not familiar with. No shit. On a US army base.

The US military currently has too many and too few recruits. Lots of people want in, because when the economy tanks the military is one of the few options left. But most of them fail the entry qualifications, so the number of qualifying recruits is still too low.

It's been done. I've a friend who got busted at age 19 for selling heroin. The judge gave him the option of enlisting and volunteering for combat duty, or doing hard time in the state pen. He chose the former--which in those days, was effectively getting a ticket to Vietnam.

There's a photo somewhere showing one of the last US helicopters to take off from Saigon in April 1975. In the photo you can a soldier dangling from one of the landing skids. That's my friend.

I think the free market solution would simply be having enough ISPs so that if one pulls stuff like this you can just switch to another. Some sort of "competition". I suggest we find out why there is only one fast ISP per area, and fix that problem.

Here's a hint: It's the same reason there is only one electricity provider in most areas. Generally, it is not cost efficient to run multiple sets of wires, but everyone wants electricity.

and fix that problem.

The solution is the same as with electricity. We've tried all the other solutions, many, many, many times over, and we keep coming back to the same small set of best answers; all over the world, in all kinds of cultures and every shade of We

It's called a natural monopoly. It occurs when the capital cost of entering a market is so high as to render doing to prohibitive for all but the first entry.

Verizon or another of the major ISPs comes first. That means they pay for laying cables, renting mast space, installing equipment and lobbying local government for the appropriate rights. It costs them a fortune, but they can be assured of a return because they'll have 100% of the market - there's no other option for potential customers.

Educated guess?The sites made up of custom code written before HTTPS was really all that common. It's such a mess that adding it now would require just as much work as just flat out rewriting the whole site. Last time they tried a site redesigned all the neck beards on here started shooting rocksalt at them and screaming "GET OFF MY LAW!!!"

I suspect this site barely pays for itself. I do not anticipate any large site redesigns ever.

Soylent News runs on Slashcode (although a fork of an earlier version, I think). HTTPS works just fine, as does Unicode and probably a few other things broken on Slashdot. No IPv6 yet but I'm sure it's coming. It's all on Github so it would be fairly trivial to merge it in to Slashdot.

TLS (or lack thereof) is, or at least should be, completely transparent to the Perl-based web application powering the site. In fact, the HTTP request itself doesn't even specify anything about the protocol. The request line has the path and stuff after it, and the Host header has the domain name, but doesn't mention the protocol. The absolute minimum they should do would be to return *exactly* the same content over HTTPS that they do over HTTP for a given request (remember, the HTTP traffic is the same whe

There are tons of reports (just google them) of the server side cpu load being minimal to encrypt traffic. My guess is either the load balancing setup they have doesn't support SSL or their 3rd party ad network doesn't.

In general, I think sites don't support https because of a) the extra cost of a cert, b) they don't care, c) the extra cost of a dedicated IP (SNI isn't supported on IE on XP). You can say "screw XP" all you want, but a good 20% still (of at least my traffic) comes from IE on XP.

For all users other than subscribers and karma-capped users who have checked "Disable Advertising", Slashdot is funded by advertisements. Using an HTTP ad network from an HTTPS site would be blocked as mixed content, and HTTPS support among ad networks is very new. AdSense, for example, didn't support HTTPS until September of last year.

For cellular at least, Verizon keeps pretty tight control over what devices they allow on their network. All they would need to do is to start shipping phones with a Verizon root cert installed that can't be removed. Phone trusts the cert, Verizon proxy performs MITM on SSL traffic...

just like you can NEVER trust a windows (or mac or even linux box) that was not setup by you, especially if its a corporate box that was given to you pre-installed.

almost every company of mid-size or larger preinstalled MitM certs for their spying firewalls. they don't tell employees that, but netadmins and sysadmins pretty much all know this.

I work at a large networking company and they didn't tell me WHAT they do or HOW they'd spy on me, but I found out via a friend (in germany) exactly what they are doing. in.de, you have to disclose to the employees a lot more than the US requires you to do, and he relayed the info to me about how our corp laptops come preinstalled with corp spyware. ability to active mic, camera, screen caps, all that bullshit in addition to traffic logging.

I'm a network mgmt guy and when I was out interviewing for jobs (the last few years) almost all of them involved DPI and MitM attacks, even though they tried to explain it away as 'troubleshooting information' and 'for the users benefit'. quite bullshitty but they said it with a straight face, like they believe their own BS.

you guys have to start realizing that corp america is all about privacy invasion; of customers and employees, alike. if you have a corp laptop, do NOT login to your home email systems and keep your work laptops entirely clean of anything personal and home related. yeah, even if you see the lock icon on the browser, it means nothing anymore, in a corp LAN.

Except, it's more like pennies. That's what's hilarious about all this privacy invading nonsense we've been subjected to. It's not valuable. They do not make more money with it. Sure, at first it sounds like a great idea. But the mountains of data it generates quickly become completely useless and you just end up sitting on it all and doing nothing with it. I've dealt with marketing people and seen them install their huge data tracking software packages that they paid fortunes for. Several years later and t

I wonder... if we wrote addons for popular browsers that would inject bogus X-UIDH headers into every request, whether we could make this kind of inappropriate privacy intrusion prohibitively expensive. If it works as he surmises, maybe we can overwhelm Verizon's ad exchange platform with meaningless data.

This plan. I like this plan! Put a random value in the header on every request. If you're not on Verizon, it'll look like you are (but as a different person every time). If you *are* on Verizon, you may just confuse the software that is adding those headers, or that is logging them. Poison their tracking data with meaningless garbage, and make it *cost* Verizon money to try and track us.

Well, that and use HTTPS everywhere possible, of course. But that requires that the sites you use allow people to do so (*AHEM* Slashdot, looking at you...)

Oh, and don't use Verizon. That's the best way to hit them in the pocketbook, by far. I like the idea of sending the header even when you don't use Verizon though, as a general-purpose "fuck you!" to them.

God. it's like you people don't even appreciate the value added service they are *GIVING* away here. Who wouldn't want to see more perfectly tailored and targeted ads -- some of which even include *VIDEO* again, completely for free.

You have to pay for cable right? The same thing applies, you're getting the service you paid for (TV shows, home shopping channels) with the added bonus of free to view advertisements.

Vodafone injects the X-VF-ACR header: 'Vodafone Anonymous Customer Recognition'. It is unclear what this header exactly does; all headers that have been seen start with the string "204004DYNMVFNLACR", followed by 16 X's, and are followed by a BASE64-encoded 256-byte cyphertext, which we were unable to decrypt. It has been suggested that this string might contain the SIM-card identifier (IMSI) or other personal information, as was found in a research conducted by Mulliner in 2010 [14]. Vodafone did not respond to requests of explaining this header. Nevertheless, the presence of this header, certainly identifies customers of Vodafone as being customers of Vodafone.

No, it's actually much worse than that. Slashdot supports HTTPS just fine. They simply force you back to HTTP (using a redirect *out* of HTTPS whenever you request an HTTPS page)! Total bullshit; there's no legitimate reason for such behavior. Even without dedicated TLS hardware, the overhead of HTTPS is pretty trivial for modern servers.

Tell that to the operators of ad networks. If the ad network is HTTP while the rest of the page is HTTPS, it gets blocked as mixed content. That's probably why Slashdot redirects non-subscribers' page views to HTTP.

Where did you check from? You don't see the headers on your end; they're only added at the ISP gateway. Unless you were able to bounce a request off an external web server and see the headers that it *received* - which don't have to be the ones you sent - then you don't know. Oh, and don't use HTTPS for the test, since they obviously can't modify those requests.

I just checked using http://centralops.net/co/ [centralops.net] over my Verizon mobile phone and sure enough there is the X-UIDH header. Well, this cements my plan to switch carriers in a month when my contract expires. Any tips on moving to a pay-as-you-go plan that lets me keep my phone number?

> Any tips on moving to a pay-as-you-go plan that lets me keep my phone number?

DO NOT cancel your account!

call the new company, say you want to port your number.

the system is F*up... you will have to give the new co your account number AND PASSWORD for the old one. so if it is your SSN as it is by default, change it before if you care (or stop believing that SSN is secret, you are a grow up).

anyway, i cancelled ATT and then ported to TMOBILE. ATT was obliged by law to reactivate my account to complete t

I just checked with my AT&T mobile phone and found an "x-acr" header which seems to serve much the same purpose, so switching away from Verizon might not help. (The header is not present when accessing the site through a VPN, so it wasn't sent by the browser.)

Does that unique identifier get passed down all the way to the server you're trying to connect to, even if you go through a proxy server or reset your router? This is significantly worse than MAC or IP addresses.

I always find it interesting when people post thing like this and never mention the brand/model of the product so the rest of us can avoid it. It's like we've gotten so worked about lawsuits we censor ourselves now.

Not really. Even if your derivative work idea was valid and could be used to stop Verizon, they would just update their Terms of Service (TOS) to explicitly have you grant them this right and waive any claims.

Frankly, while i haven't checked, is very likely that their existing TOS grants them the right to make any change to your traffic they see fit, so it's likely that any derivative work would fail on it's face based on your existing contract.